Between October 2012 and October 2013, Love and fellow conspirators sought out and hacked into thousands of computer systems. Once inside the compromised networks, Love and his conspirators placed hidden “shells” or “back doors” within the networks, which allowed them to return to the compromised computer systems at a later date and steal confidential data. The stolen data included the personally identifying information (PII) of thousands of individuals, some of whom were military servicemen and servicewomen, as well as other nonpublic material.

The attacks were said to have been carried out through a mixture of SQL injection and an exploitable vulnerability in the Adobe Cold Fusion product.

Love was arrested and bailed in the UK, with the ultimate goal of deciding, “Should he be extradited to the US to stand trial?”

After being released from his bail obligations in the UK (though not released from the risk of extradition), Love decided to fight the UK’s National Crime Agency (NCA) for the return of computer devices that were confiscated when he was arrested.

The dispute came about, it seems, because the NCA was keen to hang on to devices that contained data that hadn’t yet been decrypted, in case it might later turn out to have bearing on the case.

Love was understandably just as keen to get the devices back, claiming at the time that there was no “overt evidence of criminality sufficient to bring prosecution.”

Shortly after that, in July 2015, Love was rearrested in the UK and has been battling extradition ever since.

In a judgment handed down in the UK today, Love seems to have won the extradition battle for now: the High Court of Justice in London today ruled that his mental health would be jeopardised by trial and possible imprisonment in the US.

The UK court accepted that he was likely to be sent him to prison for longer if he were found guilty in the US, and that being separated from his family might make him a suicide risk.

The Crown Prosecution Service [CPS – the principal prosecution agency in England and Wales] must now bend its endeavours to his prosecution [in England], with the assistance to be expected from the authorities in the United States, recognising the gravity of the allegations in this case, and the harm done to the victims. […] If proven, these are serious offences indeed.

Love’s 2013 US indictment alleges, based on chat logs, that he said that he’d acquired “basically every piece of information you’d need to do full identity theft on any employee or contractor”, and that “you have no idea how much we can f**k with the US government if we wanted to,”…

…so Love may yet face a vigorous trial in the UK.

As the court found in today’s judgement, “the other side of the coin [to preventing extradition] is that prosecution in this country rather than impunity should then follow.”

What a crock of it … should have been extradited, you don’t want to face American punishment, don’t commit crimes in America. The fact he has to resort to “i’ll kill myself” just shows what kind of person we’re talking about. Hope the UK persecutes to the fullest extent.

Whilst I agree that prosecution SHOULD be undertaken, I find your tone slightly amusing given the fact that the US has consistently and constantly refused to extradite its citizens to face justice elsewhere. Bit of an “our justice is better than your justice” kind of thing?

Not sure that’s true. The US *does* extradite suspects, even if it doesn’t do so as frequently as other countries might like. So there simply isn’t the “consistent and constant” refusal you suggest.

(This is going back a bit, but in the early 1990s, the world’s first ransomware suspect – James Popp, who created the AIDS Informtion Trojan at the end of 1989 – was sent from the US to the UK for trial, even though Popp wasn’t physically in the UK when he committed his alleged crimes.)

It’s the UK that’s been the high profile non-hacker-extraditor in recent years: Gary McKinnon and now Lauri Love.

So this guy hacks systems containing info from th US government and military, and the UK refuses extradition while they have possession of all the info this guy stole? Surely I’m not the only one who sees a problem with this. Then, almost as an afterthought, they say they expect full cooperation from the authorities in America. Wow.

My reading of the part that you see as “they expect full co-operation from the authorities in America” is a bit more concilatory.

I think the court decided it had a duty under English law to show some basic concern and compassion over Love’s mental state, but that he nevertheless needs to face the music for the serious charges against him. So I read this more along the lines of, “Given that we will have to prosecute him here now, we do earnestly hope that our friends across the water will accept the inconvenience, time and money of coming over here and helping us to throw the book at him.”

This is not unusual where tricky jurisdictional issues arise. (For example, when the suspect is in Russia and local law prohibits extradition of Russian citizens; or in Northern Cyprus, where extradition introduces the international complication of recognising Northern Cyprus as a soverign state. The approach then is to bring the case to the suspect, not the suspect to the case.)